Vietnam Issues Guidelines on Cloud Computing for E-Government Deployment

April 15, 2020

Vietnam Issues Guidelines on Cloud Computing for E-Government Deployment

On April 3, 2020, Vietnam’s Ministry of Information and Communication (MIC) issued Official Letter No. 1145/BTTTT-CATTT to provide guidelines on a set of technical criteria and specifications for cloud computing solutions for e-government deployment (the “Guidelines”).

State agencies and organizations will rely on these Guidelines to assess and select solutions or lease cloud computing services for the development of e-government. Private-sector entities are also encouraged to refer to these Guidelines when setting up and deploying their own cloud computing platform solutions.

The set of technical criteria and specifications include two groups of criteria: Group 1 – technical criteria and specifications, and Group 2 – criteria for information security.

Group 1 includes criteria, specifications, and features related to: (1) virtual machines, (2) storage devices, (3) networks and software-defined networking, (4) physical machines, (5) administration and operation, and (6) integration and other relevant requirements.

Group 2 includes requirements related to: (1) basic requirements on information security features and (2) requirements for setting up security configurations for cloud computing infrastructure.

These two groups are specified in detail in the Guidelines and its annexes. Annex 1 related to Group 1 sets out the minimum technical criteria and specifications for cloud computing infrastructure, and sets out a table to describe features, criteria, and specifications for each specific feature. If a feature has only one criterion or technical specification, a cloud computing solution is evaluated as “passing” when the solution provides that feature and “not passing” if the solution does not provide that feature. If a feature has many different criteria and specifications, that feature is evaluated as “passing” when all criteria and technical specifications are met or “not passing” when at least one of the criteria or technical specifications is not achieved. Similarly, Annex 2 related to Group 2 sets out the minimum technical criteria and specifications for information security of cloud computing infrastructure.

The Guidelines also provide the concept of cloud computing (definition and basic characteristics of cloud computing), the classification of methods for deploying cloud computing (public cloud, private cloud, hybrid cloud, and multi-cloud) and the classification of cloud computing service provision models: IaaS (Infrastructure as a Service) – suitable for private cloud deployment; PaaS (Platform as a Service) – suitable for public cloud deployment; and SaaS (Software as a Service) suitable for public cloud.

Furthermore, the Guidelines provide two options for deploying a cloud computing platform: self-deployment, administration, and operation; or leasing professional cloud computing services from other companies.

With regard to the option of self-deployment, administration, and operation, state agencies and organizations are required to have an experienced, capable team to build, administrate, operate, maintain, and ensure information security of the platform. Therefore, they are recommended to implement the second option of leasing professional cloud computing services. However, for certain information systems with specific requirements and which require system administrators to self-manage and operate, state agencies and organizations need to consider hiring professional enterprises to build cloud computing infrastructure. After the system is built, the professional enterprises will hand it over, transfer technology, and provide training and guidance on system administration and operation.

With the option of leasing professional cloud computing services, the MIC recommends that state agencies and organizations prioritize the selection of cloud computing service providers which meet technical criteria and specifications and are on the list announced by the MIC. Selected cloud computing service providers must comply with relevant laws and regulations on network information security, comply with stipulated technical standards, and fulfill technical criteria and specifications stipulated in these Guidelines.

For more information on the cloud computing technical criteria and specifications, please contact us at [email protected].

Related Professionals

Thomas J. Treutler

Partner and Managing Director, Vietnam

Vietnam

+84 28 628 45678

Email

Giang Thi Huong Tran

Vietnam

+84 24 3772 5560

Email

RELATED INSIGHTS

November 15, 2024

Changes to Domain Name Dispute Resolution Under Vietnam’s New Internet Decree

Vietnam’s new Decree No. 147/2024/ND-CP on the management, provision, and use of internet services and online information (“Decree 147”), which will come into effect on December 25, 2024, replacing Decree No. 72/2013/ND-CP (“Decree 72”), introduces several changes to the regime for domain name dispute resolution. The new decree aims to clarify the legal framework and address some longstanding inconsistencies between Vietnam’s laws on intellectual property and information technology. The main changes related to domain name dispute resolution under Decree 147 are summarized below. Removal of Prescriptive Actions Decree 147 no longer lists specific actions for resolving domain name disputes. Decree 72 had outlined three methods: negotiation/mediation, arbitration, and court. However, IP practitioners had long criticized this approach, arguing it conflicted with the IP Law, which additionally allows administrative action. By omitting these methods, the new decree implies an acceptance of administrative action as provided in the IP Law. However, Decree 147 remains silent on establishing a dispute resolution forum aligned with the CPTPP’s requirement for a UDRP-like model. Currently, Vietnam’s available forums do not fully conform to the UDRP framework. An anticipated circular may provide further guidance on this aspect. Deactivation of Domain Names Decree 72 does not have any provision on the deactivation of a domain name. However, Decree 147 has stipulated some situations where domain names will be deactivated, such as when there is a request from an authority, or when it is discovered that incorrect information was used for registration. Clearer Criteria for Dispute Resolution Article 16 of Decree 147 sets out three clear criteria that must be met for domain name dispute resolution to proceed: (i) confusing similarity with the plaintiff’s trademark, trade name, or personal name; (ii) the defendant’s lack of legitimate rights or interests in the domain name; and (iii) bad faith. Previously,

November 15, 2024

Vietnam Issues New Decree Governing Internet Services and Online Information

On November 9, 2024, the government of Vietnam promulgated Decree No. 147/2024/ND-CP on the management, provision, and use of internet services and online information (“Decree 147”). This decree supersedes the previous Decree No. 72/2013/ND-CP dated July 15, 2013, on the same topic (“Decree 72”) and its amending regulations, and will take effect on December 25, 2024. Spanning over 200 pages, with an appendix of 62 forms, Decree 147 addresses a wide range of key internet and online topics, including internet services; domain names; cross-border information provision; social network services; aggregated information websites; online game services; app store services; information content services on mobile telecom networks; responsibilities of telecom, internet, web hosting, data center, and telecom application service providers; and measures to handle illegal content. This decree is expected to have a significant impact on both onshore and offshore service providers in the respective fields, and will potentially tighten the regulatory landscape for internet services and online information provision in Vietnam. Some highlights from the new Decree 147 compared to its predecessor are detailed below. Cross-Border Information Provision Offshore service providers, including offshore social network service providers and offshore app store service providers, who provide services on a cross-border basis and either lease data storage in Vietnam or meet a threshold of 100,000 or more total visits per month from Vietnam for six consecutive months must adhere to stricter requirements than other providers. Notable obligations of these regulated cross-border providers include: Notifying the Authority of Broadcasting and Electronic Information (ABEI) of their contact information. Monitoring and removing illegal content. Storing and managing user data as required. Authenticating social network user accounts using Vietnamese mobile number or ID number. Reporting to the ABEI annually as well as on an ad hoc Handling user complaints. Only cross-border providers who have notified the

November 13, 2024

Thailand to Set Additional Obligations for Specific Digital Marketplaces

Thailand’s Electronic Transactions Committee has publicized a new draft notification detailing additional duties for specific marketplace digital platform service operators under Section 18(2) of the Royal Decree on Operation of Digital Platform Service Businesses Subject to Prior Notification B.E. 2565 (2022). The draft notification, which is open for public comments until November 30, 2024, aims to provide enhanced protection for users of “specific marketplace platforms” (defined below). Some key points of the draft notification are detailed below. Scope The draft notification applies to “marketplace digital platform services,” which refers to digital platform services that serve as an intermediary for buying or exchanging goods and provide services to facilitate sale transactions, such as providing communication systems (e.g., chat features), shopping carts, delivery arrangements, and supplemental payment processing facilitation. “Specific marketplace platforms” refers to Section 18(2) of the Royal Decree on Digital Platform Services, which covers digital platform services that pose risks to financial and commercial security, the reliability and credibility of data messaging systems, or potential harm to the public, and that have a high level of potential impact based on the criteria for assessing the impact of digital platform service operations. Key Obligations Registration. The draft notification requires the marketplace operators mentioned above to be registered as legal entities in Thailand. Terms and conditions. The draft notification details additional obligations relating to marketplace operators’ terms and conditions: In addition to existing obligations prescribed in the Royal Decree and the relevant subordinate laws, the draft notification emphasizes that the terms and conditions must be in Thai, clear, accessible, and understandable, and may include graphical elements to aid explanation. The terms and conditions must prescribe conditions relating to the sale of products subject to specific standards, such as those restricted under the Food Act, the Drugs Act, and the Industrial Product

November 11, 2024

Vietnam’s Digital Hub Aspirations Will Open Opportunities for Investors

The Vietnamese government has demonstrated a strong commitment to building a digital government, digital economy, and digital society through its recently issued national strategy on digital infrastructure. Under Decision No. 1132/QD-TTg dated October 19, 2024, on “Digital Infrastructure Strategy to 2025 with Orientation to 2030,” the government will create supportive conditions for both domestic and international businesses to invest in digital infrastructure with cybersecurity as a priority. Recognized as vital to the economy, this digital infrastructure will consist of four main components: (i) telecommunications and internet infrastructure, (ii) data infrastructure, (iii) physical-digital infrastructure, and (iv) digital utility infrastructure, including digital technology as a service. Key goals for 2025 include universal fiber optic access for households, 100% 5G coverage across all provinces and cities, deployment of at least two new international undersea fiber optic cables, establishment of AI data centers, development of green-standard data centers, and platforms for IoT, AI, big data, blockchain, and cybersecurity. By 2030, goals include fiber access with speeds of at least 1 Gbps, 5G coverage for 99% of the population, readiness for 6G trials, six additional international undersea fiber optic cables, development of a hyperscale data center, and positioning Vietnam as a digital hub. To achieve these goals, the government has outlined some core tasks, creating significant opportunities for both foreign and domestic investors: Developing telecommunications and internet infrastructure for widespread fiber optic and 5G access, while preparing for emerging technologies like 6G, Open RAN, satellite, and IpV6. Telecommunication enterprises will jointly invest in and share the use of international fiber optic cable routes to ensure efficient capacity utilization and optimize investment capital. Attracting foreign and domestic investment to establish hyperscale data centers and cloud computing services that meet global standards. Creating physical-digital infrastructure by integrating technology across key sectors such as transportation, energy, healthcare,

You are using an outdated browser and your browsing experience will not be optimal. Please update to the latest version of Microsoft Edge, Google Chrome or Mozilla Firefox. Install Microsoft Edge

Industries

Practices

April 15, 2020